Detonate URL - JoeSecurity Deprecated

id: detonate_url_-_joesecurity
version: -1
name: Detonate URL - JoeSecurity
fromversion: 5.0.0
deprecated: true
description: |-
  Deprecated. Use the joe-submit-url command instead.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: 680422e2-0806-4f2d-8d20-bc7f2589238e
    type: start
    task:
      id: 680422e2-0806-4f2d-8d20-bc7f2589238e
      version: -1
      name: ""
      description: ""
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "1":
    id: "1"
    taskid: 172af11a-ff1d-48ba-8d65-3c6f625689c5
    type: regular
    task:
      id: 172af11a-ff1d-48ba-8d65-3c6f625689c5
      version: -1
      name: JoeSecurity Upload URL
      description: ""
      script: Joe Security|||joe-analysis-submit-url
      type: regular
      iscommand: true
      brand: Joe Security
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      comments:
        complex:
          root: inputs.Comments
      internet-access:
        complex:
          root: inputs.InternetAccess
      should_wait: {}
      systems:
        complex:
          root: inputs.Systems
      url:
        complex:
          root: inputs.URL
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "2":
    id: "2"
    taskid: dba7628f-dc23-4f39-8024-fe36dcd71e94
    type: playbook
    task:
      id: dba7628f-dc23-4f39-8024-fe36dcd71e94
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      Ids:
        complex:
          root: Joe.Analysis.ID
      Interval:
        complex:
          root: inputs.Interval
      PollingCommandArgName:
        simple: webid
      PollingCommandName:
        simple: joe-analysis-info
      Timeout:
        complex:
          root: inputs.Timeout
      dt:
        simple: Joe.Analysis(val.Status != 'finished').ID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 50,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "3":
    id: "3"
    taskid: 2e8a7348-8be0-44ac-821e-66db69ba0d74
    type: regular
    task:
      id: 2e8a7348-8be0-44ac-821e-66db69ba0d74
      version: -1
      name: JoeSecurity Get Report
      description: ""
      script: Joe Security|||joe-download-report
      type: regular
      iscommand: true
      brand: Joe Security
    nexttasks:
      '#none#':
      - "5"
    scriptarguments:
      type:
        complex:
          root: inputs.ReportFileType
      webid:
        complex:
          root: JoeAnalysis
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: JoeAnalysis.Status
                iscontext: true
              right:
                value:
                  simple: finished
          accessor: ID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "5":
    id: "5"
    taskid: 8424c0cf-cc75-47b6-81f8-b4b382cb2a94
    type: title
    task:
      id: 8424c0cf-cc75-47b6-81f8-b4b382cb2a94
      version: -1
      name: Done
      description: ""
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "6":
    id: "6"
    taskid: c02313e8-5f5f-4612-88dd-ff62f62ba263
    type: condition
    task:
      id: c02313e8-5f5f-4612-88dd-ff62f62ba263
      version: -1
      name: Is there a URL to detonate?
      description: Look for URLs to detonate
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "1"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: inputs.URL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "7":
    id: "7"
    taskid: 250f4b2f-28ad-4d9c-8db7-01e64d60fade
    type: condition
    task:
      id: 250f4b2f-28ad-4d9c-8db7-01e64d60fade
      version: -1
      name: Is JoeSecurity sandbox enabled?
      description: Check if integration instance is enabled
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "5"
      "yes":
      - "6"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Joe Security
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 275,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "8":
    id: "8"
    taskid: 3f645918-1a91-4ba5-8a95-5d60fb441e43
    type: regular
    task:
      id: 3f645918-1a91-4ba5-8a95-5d60fb441e43
      version: -1
      name: JoeSecurity Get Info
      description: Get Info
      script: Joe Security|||joe-analysis-info
      type: regular
      iscommand: true
      brand: Joe Security
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      webid:
        complex:
          root: Joe
          accessor: Analysis.ID
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
  "9":
    id: "9"
    taskid: 9c83e0a7-8cce-4a67-8320-90f35a40d2ef
    type: regular
    task:
      id: 9c83e0a7-8cce-4a67-8320-90f35a40d2ef
      version: -1
      name: Set Context
      description: reduce context level for future filters
      scriptName: Set
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "3"
    scriptarguments:
      append: {}
      key:
        simple: JoeAnalysis
      value:
        complex:
          root: Joe
          accessor: Analysis
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1435,
        "width": 605,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: false
  description: URL to detonate.
- key: Interval
  value:
    simple: "1"
  required: false
  description: Duration for executing the pooling (in minutes)
- key: Timeout
  value:
    simple: "15"
  required: false
  description: The duration after which to stop pooling and to resume the playbook (in minutes)
- key: Systems
  value: {}
  required: false
  description: 'Operating system to run the analysis on (comma-separated). Supported values are: w7, w7x64, w7_1, w7_2, w7native, android2, android3, mac1, w7l, w7x64l, w10, android4, w7x64native, w7_3, w10native, android5native_1, w7_4, w7_5, w10x64, w7x64_hvm, android6, iphone1, w7_sec, macvm, w7_lang_packs, w7x64native_hvm, lnxubuntu1, lnxcentos1, android7_nougat'
- key: Comments
  value: {}
  required: false
  description: Comments for the analysis.
- key: InternetAccess
  value:
    simple: "True"
  required: false
  description: Enable internet access (boolean). True= internet access (default), False= no internet access.
- key: ReportFileType
  value:
    simple: html
  required: false
  description: 'The resource type to download. Default is html. Supported values are: html, lighthtml, executive, pdf, classhtml, xml, lightxml, classxml, clusterxml, irxml, json, jsonfixed, lightjson, lightjsonfixed, irjson, irjsonfixed, shoots (screenshots), openioc, maec, misp, graphreports, memstrings, binstrings, sample, cookbook, bins (dropped files), unpackpe (unpacked PE files), unpack, ida, pcap, pcapslim, memdumps, yara'
outputs:
- contextPath: DBotScore.Vendor
  description: The vendor used to calculate the score.
  type: string
- contextPath: Joe.Analysis.ID
  description: Web ID
  type: string
- contextPath: Joe.Analysis.Status
  description: Analysis Status
  type: string
- contextPath: Joe.Analysis.Comments
  description: Analysis Comments
  type: string
- contextPath: Joe.Analysis.Time
  description: Submitted Time
  type: date
- contextPath: Joe.Analysis.Runs
  description: Sub-Analysis Information
- contextPath: Joe.Analysis.Result
  description: Analysis Results
  type: string
- contextPath: Joe.Analysis.Errors
  description: Raised errors during sampling
- contextPath: Joe.Analysis.Systems
  description: Analysis OS
- contextPath: Joe.Analysis.MD5
  description: MD5 of analysis sample
  type: string
- contextPath: Joe.Analysis.SHA1
  description: SHA1 of analysis sample
  type: string
- contextPath: Joe.Analysis.SHA256
  description: SHA256 of analysis sample
  type: string
- contextPath: Joe.Analysis.SampleName
  description: Sample Data, could be a file name or URL
  type: string
- contextPath: DBotScore.Indicator
  description: The name of the sample file or URL
  type: string
- contextPath: DBotScore.Type
  description: '''url'' for url samples, otherwise ''file'''
  type: string
- contextPath: DBotScore.Score
  description: The actual score.
  type: number
- contextPath: DBotScore.Malicious.Vendor
  description: The vendor used to calculate the score.
  type: string
- contextPath: DBotScore.Malicious.Detections
  description: The sub analysis detection statuses
  type: string
- contextPath: DBotScore.Malicious.SHA1
  description: The SHA1 of the file
  type: string
- contextPath: InfoFile.Name
  description: FileName
  type: string
- contextPath: InfoFile.EntryID
  description: The EntryID of the sample
  type: string
- contextPath: InfoFile.Size
  description: File Size
  type: number
- contextPath: InfoFile.Type
  description: File type e.g. "PE"
  type: string
- contextPath: InfoFile.Info
  description: Basic information of the file
  type: string
- contextPath: File.Extension
  description: File Extension
  type: string
- contextPath: InfoFile
  description: Report file object
  type: unknown
- contextPath: File
  description: File object
  type: unknown
- contextPath: Joe.Analysis
  description: Joe analysis object
  type: unknown
- contextPath: DBotScore
  description: DBotScore object
  type: unknown
- contextPath: DBotScore.Malicious
  description: DBotScore malicious object
  type: unknown
tests:
- No test